4ca7e3375a31026defef7238186b56b72d771f2c4d80e5ed2e730050f0ac4208

General

Target

4ca7e3375a31026defef7238186b56b72d771f2c4d80e5ed2e730050f0ac4208
Size

63KB
MD5

96f5ebdc74813f60cb5f384367f6e0b2
SHA1

df522e989b01cbe56a6d3477a09acf3078fb1b8b
SHA256

4ca7e3375a31026defef7238186b56b72d771f2c4d80e5ed2e730050f0ac4208
SHA512

2b1a208df508da456ff251ac63299bd906f5ff7f533df8ea5a5740c9e075205f3f4b6977d04c425fa4e90de710ce3a02b8c542c9ce308985460e17937d8fa57f
SSDEEP

1536:GccZyw321TOc/i5DTlaVrc8Q6pvUleoJ6lTFzarcBYC:lcZyaiTbi53CIN6pvUlQlTFzarcBF

Score

N/A

Malware Config

Signatures

Files

4ca7e3375a31026defef7238186b56b72d771f2c4d80e5ed2e730050f0ac4208
.exe windows x86

c8843875179f2aaebb76765824ec9b0e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

hal

KeAcquireQueuedSpinLock

ntoskrnl.exe

RtlInitUnicodeString
ZwCreateKey
ZwQueryValueKey
RtlAddAccessAllowedAce
RtlCreateAcl
RtlLengthSid
RtlInitializeSid
SeExports
ExInterlockedAddLargeInteger
ObReleaseObjectSecurity
SeSetSecurityDescriptorInfo
ExAllocatePoolWithTag
RtlLengthSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
ObGetObjectSecurity
IoDeleteDevice
ExDeleteNPagedLookasideList
IoQueueWorkItem
ZwNotifyChangeKey
MmPageEntireDriver
IoFreeWorkItem
ExInitializeNPagedLookasideList
IoAllocateWorkItem
IoCreateDevice
DbgBreakPoint
KeReadStateEvent
KePulseEvent
MmAdvanceMdl
KeBugCheckEx
ExInterlockedFlushSList
KeSetTimerEx
KeInitializeDpc
KeInitializeTimer
MmLockPagableDataSection
KeSetTimer
MmUnlockPagableImageSection
KeRemoveQueueDpc

Sections

.text
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.INIT
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 256B - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c8843875179f2aaebb76765824ec9b0e

Headers

File Characteristics

Imports

hal

ntoskrnl.exe

Sections

.text Size: 37KB - Virtual size: 37KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 16KB - Virtual size: 16KB

.INIT Size: 1024B - Virtual size: 1024B

.reloc Size: 256B - Virtual size: 204B

.text
Size: 37KB - Virtual size: 37KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 16KB - Virtual size: 16KB

.INIT
Size: 1024B - Virtual size: 1024B

.reloc
Size: 256B - Virtual size: 204B